1. Field of the Invention
The invention relates to elevator systems having a plurality of elevator cars under the group supervisory control of at least two cooperative system processors.
2. Description of the Prior Art
The use of computers, and microcomputers, in the control of elevator systems has substantially reduced the physical size of the control packages, and has increased the reliability of such systems. Computers, however, use relatively low voltages to signify a bit of information, and they also use high speed, serial, sequenced operations controlled by a system clock. Despite elaborate shielding, electrical noise can randomly occur in the signals, causing problems such as software timing and sequencing errors. Such problems can be corrected by simply reinitializing the system, in the same manner as when electrical power is initially applied to the system. Thus, when an abnormal condition is detected, the system should be automatically reinitialized, as most problems may be resolved in this manner. If reinitializing the system does not correct the problem, the system may automatically resort to a control arrangement which allows the elevator cars to operate independently without group supervisory control, such as through-trip, or block operation, if the dispatcher processor is malfunctioning, or an individual elevator car may be taken out of service, if a car controller processor is malfunctioning. The system would then continue to operate until elevator maintenance personnel can correct the problem. Problems due to random electrical noise in a processor, however, as hereinbefore stated, may be automatically resolved, without degrading elevator service, and without necessitating a special trip by elevator service personnel.
Failure of a supervisory processor in a mode which may adversely affect the ability of the elevator cars to operate properly, may be detected by monitoring a selected function of the supervisory processor. For example, the supervisory processor includes a digital computer having an operating strategy in the form of a stored software program which must be run repeatedly to continuously update the system. U.S. Pat. No. 3,854,554, which is assigned to the assignee as the present application, suggests a hard wired timing circuit, as opposed to a software timer, whose output is held high by periodic accessing by the operating program. Failure of the supervisory control to access the timing circuit at the proper frequency allows it to time out and provide a low signal which is used to prevent signals provided by the supervisory control from being considered by the car controllers of the various elevator cars.
U.S. Pat. No. 4,046,227, which is assigned to the same assignee as the present application, discloses a dispatcher processor monitor which determines if the dispatcher processor is preparing timely command words for the elevator cars.
U.S. Pat. No. 4,162,719, which is assigned to the same assignee as the present application, discloses a dispatcher monitor which starts a timer when any hall call is registered, and it resets the timer when any hall call is reset. If the timer times out, corrective action is taken, including reinitializing the system processor.
A monitoring arrangement which is based upon detecting a specific dispatcher malfunction, may miss a malfunction which degrades, or even terminates elevator service. A dispatcher processor monitor disclosed in U.S. Pat. No. 4,397,377, which is assigned to the same assignee as the present application, monitors each registered call for elapsed registration time, to detect a dispatcher malfunction. This arrangement will detect a dispatcher malfunction, regardless of the source of the problem. Each call is subjected to a threshold test to make sure it has been registered for a sufficient time to be of concern. Calls which pass the threshold test are subjected to traffic condition tests, and a dynamic call registration time test. The dynamic call registration time test is determined according to the number of in-service elevator cars capable of serving the monitored call. If the call registration time fails a traffic condition test, or exceeds the dynamic threshold, the monitor takes corrective action.